> | Lab 6.8.1.2 Extended ACLs internet - Overview Estimated time: 90 min. Objectives: This Lab will focus on your ability to accomplish the following tasks: Design and ACL plan based on specific security requirements Work with the more advanced capabilities of extended IP Access Control Lists (ACLs) Construct an extended ACL with multiple statements Construct an extended ACL to control Internet traffic using one or more routers Construct an extended ACL to permit or deny other specific IP protocol traffic Background: This lab is a practice exercise which simulates a real-world example. You will work with multiple Extended Access Control Lists (ACLs) to simulate regulating the traffic that is allowed to pass through multiple routers to various servers and the Internet. This is primarily a paper-based exercise to practice the analysis of security requirements and design an ACL plan. You can configure the most of the ACLs on the routers indicated in the answer section but you may not be able actually test some of the ACLs filtering capabilities in some cases Extended ACLs provide a more advanced form of filtering with more flexibility in the way packets are controlled. Extended ACLs can filter (permit or deny) packets based on source or destination address and on the type of traffic (e.g. FTP, Telnet, HTTP etc.). Since extended ACLs can block based on destination address, they can be placed near the source which helps to reduce network traffic. In this lab you will work with multiple Extended Access Control Lists (ACLs) to regulate the traffic that is allowed to pass through multiple routers based on the source, destination and type of traffic. These are the steps necessary to use ACLs effectively: Determine the ACL requirements (based on company security needs etc.) Construct the ACL. Verify the statements in the ACL Apply the ACL to a router interface. Verify that the ACL is applied correctly to the intended interface. Verify that the ACL is functioning properly Tools / Preparation: This is primarily a paper-based practice exercise but access to the 5 router labs is desirable. A white board should be available to brainstorm the different ways to provide the required security. Work in teams of 2 or 3. Before beginning this lab you should read the Networking Academy Second Year Companion Guide, Chapter 6 - ACLs. You should also review semester 3 On-line Chapter 6. The following is a list of equipment required. Standard Cisco 5-router lab setup with hubs and switches Workstation connected to the router's console port with a rollover cable Web Site Resources: LAN Switching basics General information on all Cisco products - (Scroll down to chapter 15 - Switches) 1900 / 2820 series Ethernet switches 2900 series Fast Ethernet switches Terms and acronyms IP routing protocol IOS command summary Access Control Lists - Overview and Guidelines Notes: In this lab you will design a security plan using multiple extended ACLs and determine where they should be applied based on the following standard router lab setup below. There is more than one correct answer. Start with the standard lab setup shown in the overview and then draw a detailed diagram of all routers, servers and networks to help work out the requirements. Use the space provided on the next page to diagram the requirements listed below and help determine what ACLs are needed and where they should go. Step 1 - Define the ACL Requirements: The requirements and some assumptions for this lab are given below. In general it is best to try to use the fewest access-lists possible while minimizing network traffic and allowing for potential network growth. You will use extended ACLs for this exercise. Assume your enterprise servers are located on network 219.17.100.0 (off LAB-B). Allow everyone Web access (http protocol) to your web server 219.17.100.80 Allow everyone DNS access to your DNS server 219.17.100.53 Allow faculty from network 223.8.151.0 full access to any of these servers. Allow no other access to any server on the 219.17.100.0 network Assume students are all on network 210.93.105.0, and control access to or from their network. Assume router Lab-A belongs to your ISP and you do not have control over it. Do NOT allow students to use FTP to the Internet (virus alert!) Allow students all other access to the Internet Permit student access to the faculty network 223.8.151.0 for email (SMTP) Deny all other student access to the faculty network 223.8.151.0 Step 2 - Construct one or more ACLs. Group the statement above based on common characteristics and where you think the ACL should be applied. Try to create the fewest ACLs possible and still be flexible. The format or syntax of the extended IP ACL statements that you will be using is shown below: access-list list# {permit/deny} [protocol] source IP wildcard mask [port] dest. IP wildcard mask [port] [established] [log] [other options] (Note: Any number from 100 and 199 can be used for an extended IP ACL) Step 3 - Apply and Check the ACLs with lab routers (if available). If you have access to the routers in the lab you can apply and check the ACLs you have created. You may not be able to test all of the ACL filtering capabilities since you will not have an HTTP or DNS server or access to the Internet but you can test most of the filtering. Remember that only one ACL can be applied per protocol (such as IP) per direction (IN or OUT). Diagram the routers and servers and show the location of ACLs (router and interface, in or out) based on the security requirement.